Executive Summary

The vulnerability exists in Config::IniFiles versions before 3.001000 for Perl, specifically in the _make_filehandle subroutine. This subroutine uses Perl's two-argument open() call to open a filename, which can mistakenly interpret filenames containing shell metacharacters such as pipes ("| cmd", "cmd |") or redirects ("> path", ">> path") as commands or file operations instead of literal filenames.

As a result, if an attacker provides a malicious filename with these special characters to the -file argument, the system can execute arbitrary OS commands or overwrite files under the process's user ID. This happens because the open() call treats the filename as a shell command rather than a file path.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary operating system commands or overwrite files on the affected system with the privileges of the process running the Perl module. This can lead to unauthorized command execution, data loss, or system compromise if untrusted input is passed to the vulnerable -file argument.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises when untrusted input is passed to the -file argument in Config::IniFiles versions before 3.001000, allowing OS command injection or file overwrite via a 2-arg open() call.

To detect exploitation attempts or presence of this vulnerability, you can look for usage of Config::IniFiles with untrusted input to the -file argument, especially filenames containing shell metacharacters such as pipes (|) or redirects (> or >>).

Since the vulnerability involves Perl code execution, monitoring logs for suspicious commands or file truncations triggered by Config::IniFiles usage may help.

Specific commands to detect this vulnerability are not provided in the resources, but you might consider:

• Searching your codebase for usage of Config::IniFiles with the -file argument, especially with dynamic or untrusted input.
• Using grep or similar tools to find filenames or parameters containing pipe (|) or redirect (>, >>) characters passed to Config::IniFiles.
• Monitoring system logs or audit logs for unexpected command executions or file truncations related to the Perl process running Config::IniFiles.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation is to update Config::IniFiles to version 3.001000 or later, where the vulnerability is fixed.

The fix involves changing the open() call in the _make_filehandle subroutine from a two-argument form to a three-argument form, which treats filenames as literal paths and prevents command injection or file truncation.

Until you can update, avoid passing untrusted input to the -file argument in Config::IniFiles, especially inputs that might contain shell metacharacters like pipes or redirects.

Review and sanitize any inputs that are forwarded to the -file argument to ensure they do not contain malicious characters.

Useful 0 Not Useful 0